| # | Recommendation | Actions | Priority High/Low/Medium | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|--------------------------|----------------|------------------------------|----------------------------------------------------------------------------|------------| | R1 | 1. Evaluate the risk, benefit and cost of disposing of personal information that is no longer required in the Customer Relationship Management system, with a view to deleting this prior to the anticipated merger with ISA. | **Action 1.1** Work is currently underway to address the issue of CRM data retention with business units so that this can be filtered to the Contract Re-let requirements. A policy has been drafted and has been formally approved by ET August 2012. | High | August 2012 | Business Integrity Unit | The Records management team have been in communications with the business in establishing what the requirements are for this data. | Completed | | | | **Action 1.2** The second Stage of work is also underway with regards to the transfer of the data at the end of the current Capita contract. Two options are to be considered; transfer the data in its entirety or to purge the data in line with the agreed Retention Policy before transfer. | High | Update action November 2012 | Business Integrity Unit | This will also form part of discussions with the selected supplier as part of their data migration plans. | Ongoing | | | | **Action 1.3** A CRB specific Corporate File Plan retention policy has been drafted in conjunction with all CRB Records Advisors. | High | August 2012 | Business Integrity Unit | This was presented to CRB ET August 2012 with the CRM policy as per 1.1 for formal approval and agreement has now been given to implement. Actions are being taken forward with Records Advisors. | Ongoing | | R2 | 2. Develop a CRB specific Information Management plan. | **Action 2.1:** CRB currently report against the HO IM strategy every quarter. CRB will develop a plan to underpin the key principles including where we currently are and where we need to be | Medium | Update action November 2012 | Business Integrity Unit | The current Home Office Information Management Strategy plan will feed into this. DPO to draft a high level policy which will draw together the main principles of the HO strategy and also the recommendations of this report. Consideration will also be given to the implications of the merger ie Data Migration. Discussion is ongoing with the Home Office with regards to what the current CFP will look like on day one of DBS. | Ongoing | | R3 | 3. Expand the scope of the Information Asset Register (IAR) to create a tool to support information management. | **Action 3.1:** The CRB IAR has recently been updated to capture a number of key pieces of information including criticality, purpose and retention. This recommendation will form part of a larger piece of work and will form part of transition arrangements. | Medium | Update Nov 2012 | Business Integrity Unit | As per action 2.1 the arrangements for the CFP structure is yet to be agreed. The continuity of applicant data (CRM) will form part of the transition arrangements. | Ongoing | | R4 | 4. Develop key | **Action 4.1:** The Data Protection Officer has raised the monitoring of | Medium | See Notes date TBC by | Business Integrity | HO are currently piloting a number of | Ongoing | performance indicators (KPIs) to monitor use of Corporate File Plan (CFP) and monitor these at board level.

| Action 4.2: The Data Protection Officer is currently undertaking an exercise with staff across the Agency to reduce G drive space highlighting that business related information must be stored in the CFP. Updates regarding this exercise are reported in the monthly Business Integrity Unit | High | Ongoing | Business Integrity Unit | DPO currently monitors G drive size on a quarterly basis to ensure staff are storing corporate information accordingly in the CFP. There are only a small number of staff who the DPO is working with to | Ongoing to be completed ahead of DBS being set-up 30/11/12 | | R5 | 5. Evaluate and assess how best to utilise Records Advisors to promote and monitor information management good practice. | Action 5.1: The Records Advisor (RA) network has been strengthened in line with the Information Asset Owner Network. The Head of BIU now chairs a quarterly meeting and the Data Protection Officer holds a monthly meeting whilst the retention and EDRM projects are ongoing. Records Advisors are key representatives in all business areas and are seen as the main local contact for CFP related issues. This is also reflected as an objective in their PDRs. | Medium | Immediate | Business Integrity Unit | Internal Comms have been issued via team brief articles. Records Advisor network has been expanded. RA training was delivered in July for all new and existing RAs. Monthly meetings take place with RAs. Head of BIU currently chairs a quarterly meeting. Home Office have delivered some RA training on site 12th June 2012. DPO will also assess the suitability of supplementing RA training with the elements of that delivered to IAOs. | Complete | | Action 5.2: | The mandatory staff training now includes a section relating to the role of the RA, this was further highlighted in a team brief article May/June 2012 | Medium | Immediate | Business Integrity Unit | Team brief articles will be refreshed on a quarterly basis. Mandatory Annual Staff Information Management Training has now been delivered May/June 2012 with a new section incorporating all the points detailed in the report. | Complete | | Action 5.3: | The Head of BIU acts as the Agency Records Officer (ARO), nominated by the CEO, and as such sits on the Home Office ARO Forum. The Forum has developed a number of KPIs for areas such as retention, G drive usage, number of registered paper files. | Medium | Immediate | Business Integrity Unit | The CFP reports as highlighted in recommendation 4 will also monitor this. | Complete | | R6 | 6. Implement a coherent programme of training and a review of guidance available to raise the information management capabilities of staff. | | | | | | | Action 6.1: | The mandatory annual refresher training has been amended to reflect feedback from within the report ie: CFP definitions, Section 46 Code of Practice. The sessions will also reinforce the message to reflect the issue of CFP usage and G Drive storage. | Medium | Immediate | Business Integrity Unit | As above the additional training will also be delivered as part of the Home Office EDRM system implemented. | Complete | | Action 6.2: | Records Management/Data Protection communications are now included in the Security Annual Circular and Policy/Procedure reviews to ensure messages are cascaded on a regular basis. | Medium | July 2012 | Business Integrity Unit | | Complete | | R7 | 7. Evaluate the possibility | | | | | | | Action 7.1: | As part of the G drive | Medium | Immediate | Business | The Home Office | Complete | | 8. Ensure that information is managed appropriately over the merger. | exercise staff were asked to move information they are holding in PST folders into the CFP and delete the PST folder. The majority of staff have now completed this exercise and this will now be monitored each quarter. | Integrity Unit | Extend and Blend project is currently migrating all information that is stored in PST folders into inboxes due to the phasing out of PST folders. The next part of the process is to then apply date based retention to emails in inboxes. These initiatives are to encourage staff to store corporate information appropriately. A Date for the introduction of date based retention is yet to be agreed by the Home office. | |---|---|---|---| | 8.1 Discussions are ongoing with the Home Office with regards to the Corporate File structure for day one of DBS. 8.2 Transition discussions regarding data migration with ISA are ongoing and a joint migration policy will be agreed for when we become DBS | High | Nov 2012 | Business Integrity Unit | | | High | Ongoing | Business Integrity Unit | | | | | Ongoing |